1. General Provisions

This Privacy Policy is developed in accordance with the requirements of Federal Law No. 152-FZ of 27.07.2006 "On Personal Data" (hereinafter — the Personal Data Law) and defines the procedure for processing personal data and other information, as well as measures to ensure the security of information and personal data undertaken by Joint Stock Company "Moscow Research and Design Institute of Cultural, Leisure, Sports and Healthcare Facilities ‘Mosproject-4'" (hereinafter — the Operator).
1.1. The Operator considers the observance of human and civil rights and freedoms in processing personal data, including the protection of privacy and family secrets, a primary goal and condition of its activities.
1.2. This Privacy Policy applies to all information that the Operator may receive about visitors to the website mp-4.ru.

2. Key Terms Used in the Policy

2.1. Automated processing of personal data — processing of personal data using computing technology.
2.2. Blocking of personal data — temporary suspension of personal data processing (except when processing is necessary to clarify personal data).
2.3. Website — a set of graphic and informational materials, as well as computer programs and databases that ensure access to them on the Internet at https://mp-4.ru/.
2.4. Personal data information system — a set of personal data contained in databases and the information technologies and technical tools ensuring their processing.
2.5. Anonymization of personal data — actions making it impossible to identify the personal data of a specific User without additional information.
2.6. Processing of personal data — any action (operation) or set of actions (operations) performed using automation tools or without them with personal data, including collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (distribution, provision, access), anonymization, blocking, deletion, destruction of personal data.
2.7. Operator — a state body, municipal body, legal or natural person who independently or jointly organizes and/or processes personal data and determines the purposes, scope, and methods of processing.
2.8. Personal data — any information relating directly or indirectly to a specific or identifiable User of the website mp-4.ru.
2.9. Personal data allowed for dissemination — personal data to which unlimited access is granted by the data subject by providing consent for processing and dissemination according to the Personal Data Law.
2.10. User — any visitor to the website mp-4.ru.
2.11. Provision of personal data — actions aimed at disclosing personal data to a specific person or group of persons.
2.12. Dissemination of personal data — any actions aimed at disclosing personal data to an indefinite group of persons or making personal data publicly accessible, including publication in media, placement in information and telecommunication networks, or providing access by other means.
2.13. Cross-border transfer of personal data — transfer of personal data to a foreign country, foreign government, or foreign legal or natural person.
2.14. Destruction of personal data — any actions resulting in irreversible destruction of personal data in an information system and/or destruction of physical media.

3. Main Rights and Obligations of the Operator

3.1. The Operator has the right to:
● Receive accurate information and/or documents containing personal data from the data subject;
● Continue processing personal data without the subject’s consent if there are grounds provided by the Personal Data Law, even after consent is withdrawn;
● Independently determine measures necessary and sufficient to fulfill obligations under the Personal Data Law, unless otherwise provided by law.
3.2. The Operator is obliged to:
● Provide the data subject with information about the processing of their personal data upon request;
● Organize the processing of personal data in accordance with the legislation of the Russian Federation;
● Respond to requests from data subjects and their legal representatives as required by law;
● Provide necessary information to the authorized body for the protection of personal data rights within 10 days of request;
● Publish or otherwise ensure unrestricted access to this Policy;
● Take legal, organizational, and technical measures to protect personal data from unauthorized or accidental access, destruction, modification, blocking, copying, provision, or dissemination;
● Cease transfer or processing of personal data and destroy personal data as required by law;
● Fulfill other obligations under the Personal Data Law.

4. Main Rights and Obligations of Personal Data Subjects

4.1. Personal data subjects have the right to:
● Receive information regarding the processing of their personal data, except in cases provided by law;
● Request correction, blocking, or deletion of personal data if incomplete, outdated, inaccurate, illegally obtained, or unnecessary for the stated purpose;
● Give prior consent for marketing purposes;
● Withdraw consent to processing or request termination of processing;
● Appeal against unlawful actions or inaction of the Operator to the authorized body or court;
● Exercise other rights provided by Russian law.
4.2. The obligation to provide accurate personal data arises only when the data subject voluntarily provides information through feedback forms, subscriptions, or other services requiring personal data.
4.3. Persons providing false information or information about others without consent bear responsibility under Russian law.

5. Principles of Personal Data Processing

5.1. Processing must be lawful and fair.
5.2. Processing is limited to specific, predetermined, and legal purposes.
5.3. Databases cannot be merged for incompatible purposes.
5.4. Only personal data relevant to the processing purpose are processed.
5.5. Data content and volume must match the purpose. Excessive data collection is prohibited.
5.6. Accuracy, sufficiency, and relevance of personal data must be ensured.
5.7. Personal data is stored in a form allowing identification no longer than necessary, and is anonymized or destroyed when processing goals are achieved.

6. Purpose of Personal Data Processing

Purpose:
Provide User access to services, information, and materials on the website; process requests and feedback via forms

Personal Data:
Name, email address, phone numbers

Legal Basis:
Charter documents of the Operator; contracts; consent via form submission

Types of Processing:
Collection, recording, systematization, accumulation, storage, deletion, destruction, anonymization; sending informational emails

7. Conditions for Processing Personal Data

7.1. Processing is based on the subject’s consent.
7.2. Necessary for fulfilling legal obligations or international agreements.
7.3. Necessary for justice, court decisions, or acts of officials under Russian law.
7.4. Necessary for contract execution involving the data subject.
7.5. Necessary to protect rights and interests of the Operator or third parties.
7.6. Processing publicly available personal data upon request or consent.
7.7. Processing data required to be published by law.

8. Procedure for Collection, Storage, Transfer, and Other Types of Processing

8.1. The Operator ensures personal data security via legal, organizational, and technical measures.
8.2. Personal data will never be transferred to third parties except as required by law or with consent for contract execution.
8.3. Users may update their data by emailing info@mp-4.ru with "Personal Data Update."
8.4. Data is processed only as long as necessary for the purposes collected. Users may withdraw consent by emailing info@mp-4.ru with "Withdrawal of Consent."
8.5. Information collected by third-party services is managed according to their agreements and policies. The Operator is not responsible for third-party actions.
8.6. Restrictions set by the subject on data dissemination do not apply to processing in public interest as defined by Russian law.
8.7. Operator ensures confidentiality of personal data.
8.8. Personal data is stored only as long as necessary and then anonymized or destroyed.
8.9. Processing ends upon achieving goals, consent withdrawal, or unlawful processing detection.

9. Actions Performed by the Operator on Personal Data

9.1. Collection, recording, systematization, accumulation, storage, updating, retrieval, use, transfer, anonymization, blocking, deletion, destruction.
9.2. Automated processing may involve transmission over information networks.

10. User Request Response

10.1. Users may request information about the purposes, methods, and storage of their data. The Operator must respond within 10 business days.
10.2. Requests to cease processing must be fulfilled within 10 business days.

11. Confidentiality

The Operator and others with access must not disclose or distribute personal data without consent, except as required by law.

12. Final Provisions

12.1. Users may request clarifications via info@mp-4.ru.
12.2. Any changes to the Policy will be reflected here. The Policy remains in force until replaced.
12.3. The current version of the Policy is publicly available at https://mp-4.ru/privacy